12 new appliances released

Per-appliance updates on website

We've updated the website so that each appliance has its own feed of updates and announcements. Users can subscribe to a specific appliance feed (e.g., LAMP updates) or to the project-wide combined updates feed to get detailed information on new releases, updates and security issues. This should make it much easier for everyone who is interested to stay on top of things.

Common base for all appliances - TurnKey Core

The biggest technical change was a behinds the scenes re-engineering of the development process. All appliances are now built on top of TurnKey Core, from which they inherit the standard features (and bugs!) which are common to all TurnKey Linux software appliances. This improves our development leverage quite a bit the and should result in better consistency and reliability across the board. Any bugs which the community finds that can be traced back to Core will be fixed in subsequent releases of all appliances.

Usability improvements (batteries included)

One of the things we're trying to figure out is how to make our appliances more powerful and useful out of the box without adding too much bloat. For the latest release batch we did some research on popular software combos.

The results:

• Improved web interface - we've added many generically useful Webmin modules to all appliances.

• Drupal and MediaWiki appliances now include over a dozen extensions each.

• phpMyAdmin database administration frontend now standard in all LAMP-based appliances (LAMP, Joomla, MediaWiki, Drupal). The PostgreSQL and LAPP appliances feature phpPgAdmin instead.

• LAMP and LAPP stack appliances now include support for Perl and Python.

• PostgreSQL appliance includes PostGIS.

With the help of the community we would like make our appliances even more powerful in the future. Share your ideas!

Security

• Enabled SSL support out of the box where possible.

• Regenerating secret keys: We now regenerate all secret key material during installation (doh!) as it may otherwise be possible for an attacker that can intercept network traffic to bypass encryption.

  This includes the SSH keys, default self-signed SSL certificates and other appliance-specific secrets. Users of older appliances connected to an untrusted network are advised to regenerate their keys manually or migrate to the latest version.

• Password security: Set database passwords for MySQL or PostgreSQL (I.e., depending on the appliance) during installation. Refuse to accept empty passwords.

Fixed auto updates

We discovered a nasty bug that broke auto-updates whenever a package update tried to upgrade a configuration file that has been locally modified. This happened because the package management system checks for local modifications before upgrading configuration files and if the configuration file has been modified since installation the user is asked what to do - use the new package version, the local modified version or try merging the two?

Of course, asking the user what to do doesn't work in a non-interactive auto-update, so appliances are now configured to do the safe thing and always keep the locally modified version.

Users of older appliances are advised to migrate to the latest version or manually fix the auto-update mechanism.

Attention to detail

We didn't just work on the big stuff, we also fixed many small issues that bugged users (and us!) in previous versions.

For example:

• Redesigned network configuration in confconsole to fully support multiple NICs (previously the confconsole broke in that configuration).

• We now tag appliances with a release package that marks the release version of the appliance and contains the changelog.

• Embedded links to documentation and other helpful resources inside appliances.

• Increased default PHP limits in appliances that include PHP.

• Configured a more readable console font - the previous was hard to read, especially for color blind users.

• No passwords required when running in Live CD mode where security measures just get in the way (e.g., demos and training).

• Changed Webmin port from 10000 to 12321. It turns out its easy to mistake 10000 for 1000 on screen!

Funding development with premium services

Thanks to the support of our employer and the huge leverage provided by open source software we have managed to get this far with very little in the way of resources. The kind of enthusiastic feedback we have been getting from users tells us we are on the right track, but what we have managed to accomplish so far barely scratches the surface of what we believe can ultimately be accomplished with open source software appliances.

Up until now the limiting factor has been the amount of engineering resources we have been able to donate to the project. With more developers on board we could dramatically accelerate development and unlock the project's true potential much sooner. Unfortunately, it turns out that open sourcing a project does not magically attract a troupe of talented engineers eager to work for smiles and sunshine, especially when there are significant barriers to entry and much of the work involves the many unglamorous but necessary tasks that give a software appliance its polish.

Stimulating development by hiring a dedicated team of developers and sponsoring open source bounties requires considerable funding, so we are starting to explore which open source-friendly business models could sustain the project financially and support its long term health and viability.

Our best ideas involve providing premium services that will help organizations do more with less by taking full advantage of software appliances to reduce unnecessary friction and leverage cost-effective on-demand infrastructure (I.e., cloud deployment). This should be especially relevant given the current economic condition.

One of the services we believe may provide the most value to patrons is developing custom appliances. We recently completed a successful private pilot and we are now seeking additional clients for a public beta under unusually good terms (e.g., refunding unsatisfying results).

Further down the road, we would also like to explore other options. If you'd like to help, we are open to ideas.